WhatsApp OTP verification: the complete setup guide
Sending one-time passwords (OTPs) over WhatsApp is now Meta's officially supported flow, and it's quickly replacing SMS for login, signup, and transaction verification. WhatsApp OTPs are 60–90% cheaper than SMS in most countries, deliver in seconds, and convert better because users don't have to switch apps to copy the code.
This guide covers the authentication template type, the autofill button that drops the code straight into your app, code examples for sending an OTP via the API, and the SMS fallback flow you should always have.
Why WhatsApp OTPs beat SMS
Cost: ~$0.0014 per OTP in India vs ~$0.005 for SMS (3.5× cheaper); ~$0.0135 in the US vs $0.0075-0.04 for SMS. Delivery: median 2 seconds vs 10–30 seconds for SMS, with no carrier filtering. UX: WhatsApp's autofill button copies the code into your app with one tap — no manual digit entry. Conversion lift on signup flows: typically 5–15%.
The authentication template
Meta introduced a dedicated 'Authentication' template category specifically for OTPs. It has a fixed body format Meta provides ('{{1}} is your verification code. For your security, do not share this code.'), a 'Copy code' or 'Autofill' button, and a 10-minute validity. You can't customise the body text — that's what makes the category cheap and instantly approved.
Setting up WhatsApp OTPs (steps)
1) Have WhatsApp Business API access. 2) In your BSP dashboard, create an Authentication template (auto-filled — you only choose copy-code or autofill, plus language). 3) Submit — usually approved within minutes. 4) Call the send endpoint from your backend at the point you'd normally trigger SMS. 5) On send failure or delivery failure, fall back to SMS via your existing provider.
Code example (Node.js)
Most BSPs expose a /messages POST endpoint. Pseudocode: `await fetch(BSP_API+'/messages', { method:'POST', headers:{Authorization:`Bearer ${token}`}, body: JSON.stringify({ to: phone, template: 'auth_otp', variables: [code] }) })`. Always store the code server-side (hashed, 10-min TTL) and verify on submit — never trust the client.
SMS fallback strategy
Not every user has WhatsApp installed. Smart flow: send WhatsApp OTP → wait 30–60 seconds for delivery webhook → if not delivered or read, send SMS OTP. Most BSPs (LandinChat included) can run the fallback automatically — you just configure your SMS provider and the timeout window.
Frequently asked questions
How much does a WhatsApp OTP cost?
About $0.0014 in India, $0.0135 in the US — 60–90% cheaper than SMS in most countries.
Is WhatsApp OTP secure?
Yes. Messages are end-to-end encrypted, and Meta's authentication template type adds anti-fraud guidance. Always store the code server-side and verify on the server.
Can I customise the WhatsApp OTP message?
No. Meta fixes the body text for authentication templates — that's what keeps them cheap and instantly approved. You only configure code length and language.
What happens if the user doesn't have WhatsApp?
The send will fail or the message will never be read. Always implement an SMS fallback after a 30–60 second wait.
Can I use WhatsApp OTP for 2FA?
Yes — login flows, transaction signing, withdrawal confirmations all work. Use the Authentication template type for all of them.
Ready to put this into practice?
LandinChat is the official Meta Tech Partner powering WhatsApp marketing for 500+ businesses worldwide. Broadcasts, chatbot, shared inbox, integrations — one flat plan.
See pricing